Read the docs

WPGraphQL

Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

WPGraphQL records in CISA KEV

No WPGraphQL vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wpgraphql 1 record LOW

Records

14 records

TI-2021-22572 CVE-2021-47959 · GHSA-3mgf-xgf9-2wg2

WordPress Plugin WPGraphQL 1.3.5 Denial of Service

Priority HIGH 77

WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-05-15 No fix listed CWE-770
TI-2026-83176 CVE-2026-119701 · GHSA-f8vm-v352-pm3p

Email flooding in WPGraphQL via aliased password reset mutations

Priority LOW 37

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0059 Published 2026-10-30 Fixed in 2.24.1 CWE-770
TI-2026-83174 CVE-2026-119699 · GHSA-v637-6536-jqxc

Unbounded persisted query storage in WPGraphQL Smart Cache

Priority LOW 37

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00454 Published 2026-10-30 Fixed in 2.3.3 CWE-770
TI-2026-83177 CVE-2026-119702 · GHSA-wj7h-xjr7-93c6

WPGraphQL createComment lets attackers comment on hidden posts

Priority LOW 36

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00361 Published 2026-10-30 Fixed in 2.24.1 CWE-862
TI-2026-83175 CVE-2026-119700 · GHSA-rgvw-jqg8-92x3

Object existence disclosure in WPGraphQL via media and comment mutations

Priority LOW 36

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00363 Published 2026-10-30 Fixed in 2.24.2 CWE-204
TI-2026-71566 CVE-2026-109703 · GHSA-jp44-9pjg-2xq8

WPGraphQL plugin missing authorization exposes sensitive data

Priority LOW 29

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00187 Published 2026-10-13 No fix listed CWE-862
TI-2019-15200 CVE-2019-25060 · GHSA-w3xg-7q6m-3xwp

WP-GraphQL < 0.3.5 - Improper Access Control

Priority LOW 28

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01827 Published 2022-05-09 Fixed in 0.3.5 CWE-284
Open these records in search →